PHP 5.3.10-1ubuntu3.4 with Suhosin-Patch (cli)
Used in apache2 with:
The global options
memory_limit for PHP is set to
512M. So far so good.
Now a script tries to allocate more than this and fails due to the memory_limit. So far so good.
But now a strange thing happens. When I create .htacess with
php_value memory_limit "1025M" there are errors in the syslog just with requesting a simple PHP file with one echo.
Sep 21 18:14:02 ccollard2 suhosin: ALERT - script tried to increase memory_limit to 1082130432 bytes which is above the allowed value (attacker '*******', file '/home/www-data/*********/bla/test.php', line 14)
BUT when I try to set php_value to
memory_limit "1024M" no error is shown at the output.
So I tried to check some suhosin configs for this
1024M limit and found nothing.
So my initial question is:
Why does the server allow up to
1024M memory consumption even if global option is set to <1024M?
I assure that no config file overrides the global option and phpinfo() shows the globally set memory limit. The php script is not the question here. It was just a testing script.
Update: Suhosin seems to have a default value of 1024M memory allocation.
So the user can set memory_limit up to 1024M with htaccess but w/o htaccess the usual global limit. So with commented limit suhosin has an invisible limit of 1024 and the user can set this limit manually. But without manual setting the usual global limit will limit user scripts.